Hijacked maintainer account used to publish poisoned axios releases including 1.14.1 and 0.30.4. The attacker injected a hidden dependency that drops a cross platform RAT. We are actively investigating and will update this post with a full technical analysis.
axios Compromised on npm - Malicious Versions Drop Remote Access Trojan - StepSecurity
7 months ago by limerod to c/techsploits
techsploits
@reddthat.com
510
141
3
All things relating to breaking tech, tech breaking, OSS, or hacking together software to perform something completely out of the ordinary, on purpose or by accident.
go to feed...
techsploits
@reddthat.com
510
141
3
All things relating to breaking tech, tech breaking, OSS, or hacking together software to perform something completely out of the ordinary, on purpose or by accident.
go to feed...
If you were compromised follow the recovery steps mentioned in the article to reduce the damage.
Here's the hacker news discussion: https://news.ycombinator.com/item?id=47582220
save